npm malware reports, with evidence.

OpenSSF/OSV malware advisory MAL-2026-11997 blocks this version. Package ships a darwin/arm64 Go binary that opens an outbound WebSocket to a hardcoded author-controlled relay at wss://re...

OpenSSF/OSV malware advisory MAL-2026-12029 blocks this version. sextant-cli-linux-amd64 ships a Linux amd64 Go binary that, on execution, connects to a hardcoded WebRTC signaling relay a...

OpenSSF/OSV malware advisory MAL-2026-11997 blocks this version. Package ships a darwin/arm64 Go binary that opens an outbound WebSocket to a hardcoded author-controlled relay at wss://re...

OpenSSF/OSV malware advisory MAL-2026-4526 blocks this version. The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during `npm install`. (...

OpenSSF/OSV malware advisory MAL-2026-13367 blocks this version. The package's cli.js imports child_process, https, and os, reads process.env and system information (via os.tmpdir and rel...

OpenSSF/OSV malware advisory MAL-2026-12320 blocks this version. The npm postinstall script (bin/memorax-code-plugin-postinstall.mjs) unconditionally calls enableInternalDataCollectionCon...

OpenSSF/OSV malware advisory MAL-2026-13370 blocks this version. On npm install, postinstall.js unconditionally runs runSetup() which wires the package into the installer's AI tooling and...

OpenSSF/OSV malware advisory MAL-2026-13371 blocks this version. multi-acct@99.99.99 is a near-empty wrapper (index.js is a two-line stub returning name/version literals; author is the ge...

OpenSSF/OSV malware advisory MAL-2026-13369 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. kepler@2.0.999 declares its only runtime dependency,...

OpenSSF/OSV malware advisory MAL-2026-13371 blocks this version. multi-acct@99.99.99 is a near-empty wrapper (index.js is a two-line stub returning name/version literals; author is the ge...

OpenSSF/OSV malware advisory MAL-2026-13371 blocks this version. multi-acct@99.99.99 is a near-empty wrapper (index.js is a two-line stub returning name/version literals; author is the ge...

OpenSSF/OSV malware advisory MAL-2026-13369 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. kepler@2.0.999 declares its only runtime dependency,...

OpenSSF/OSV malware advisory MAL-2026-13371 blocks this version. multi-acct@99.99.99 is a near-empty wrapper (index.js is a two-line stub returning name/version literals; author is the ge...

OpenSSF/OSV malware advisory MAL-2026-13369 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. kepler@2.0.999 declares its only runtime dependency,...

OpenSSF/OSV malware advisory MAL-2026-13371 blocks this version. multi-acct@99.99.99 is a near-empty wrapper (index.js is a two-line stub returning name/version literals; author is the ge...

OpenSSF/OSV malware advisory MAL-2026-13369 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. kepler@2.0.999 declares its only runtime dependency,...

OpenSSF/OSV malware advisory MAL-2026-13371 blocks this version. multi-acct@99.99.99 is a near-empty wrapper (index.js is a two-line stub returning name/version literals; author is the ge...

OpenSSF/OSV malware advisory MAL-2026-13369 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. kepler@2.0.999 declares its only runtime dependency,...

OpenSSF/OSV malware advisory MAL-2026-13371 blocks this version. multi-acct@99.99.99 is a near-empty wrapper (index.js is a two-line stub returning name/version literals; author is the ge...

OpenSSF/OSV malware advisory MAL-2026-13369 blocks this version. LPM AI assessed this version as suspicious; the assessments disagree. kepler@2.0.999 declares its only runtime dependency,...

OpenSSF/OSV malware advisory MAL-2026-13371 blocks this version. multi-acct@99.99.99 is a near-empty wrapper (index.js is a two-line stub returning name/version literals; author is the ge...